A private body may process personal data for another purpose only where necessary to prevent threats to national or public security at a public body's request, to prosecute criminal offences, or to establish, exercise or defend legal claims unless the data subject's interests override; special categories additionally need an Article 9(2) GDPR or Article 22 exemption. (This operates alongside the GDPR's own compatibility test in Article 6(4).)
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.